mirror of
https://github.com/django/django.git
synced 2025-10-30 17:16:10 +00:00
Fixed #20650 -- Fixed {% filter %} incorrectly accepting 'escape' as argument
Thanks to grzesiof for the report and to loic84 and Alex Gaynor for the review.
This commit is contained in:
@@ -1101,6 +1101,7 @@ class Library(object):
|
||||
# for decorators that need it e.g. stringfilter
|
||||
if hasattr(filter_func, "_decorated_function"):
|
||||
setattr(filter_func._decorated_function, attr, value)
|
||||
filter_func._filter_name = name
|
||||
return filter_func
|
||||
else:
|
||||
raise InvalidTemplateLibrary("Unsupported arguments to "
|
||||
|
||||
@@ -665,8 +665,9 @@ def do_filter(parser, token):
|
||||
_, rest = token.contents.split(None, 1)
|
||||
filter_expr = parser.compile_filter("var|%s" % (rest))
|
||||
for func, unused in filter_expr.filters:
|
||||
if getattr(func, '_decorated_function', func).__name__ in ('escape', 'safe'):
|
||||
raise TemplateSyntaxError('"filter %s" is not permitted. Use the "autoescape" tag instead.' % func.__name__)
|
||||
filter_name = getattr(func, '_filter_name', None)
|
||||
if filter_name in ('escape', 'safe'):
|
||||
raise TemplateSyntaxError('"filter %s" is not permitted. Use the "autoescape" tag instead.' % filter_name)
|
||||
nodelist = parser.parse(('endfilter',))
|
||||
parser.delete_first_token()
|
||||
return FilterNode(filter_expr, nodelist)
|
||||
|
||||
Reference in New Issue
Block a user